Intel Microcode
Intel microcode is microcode that runs inside x86 processors made by Intel. Since the P6 microarchitecture introduced in the mid-1990s, the microcode programs can be patched by the operating system or BIOS firmware to workaround bugs found in the CPU after release. Intel had originally designed microcode updates for processor debugging under its design for testing initiative.
Following the Pentium FDIV bug the patchable microcode function took on a wider purpose to allow in-field updating without needing to do a product recall.
In the P6 and later microarchitectures, lists of x86 instructions are internally converted into simpler RISC-style micro-operations that are specific to a particular processor and stepping level.
Micro-operations
On the Pentium Pro, each micro-operation is 72-bits wide, or 118-bits wide. This includes an opcode, two source fields, and one destination field, with the ability to hold a 32-bit immediate value. The Pentium Pro is able to detect parity errors in its internal microcode and report these via the Machine Check Architecture.Micro-operations have a consistent format with up to three source inputs, and two destination outputs. The processor performs register renaming to map these inputs to and from the real register file before and after their execution. Out-of-order execution is used, so the micro-operations and instructions they represent may not appear in the same order.
During development of the Pentium Pro, several microcode fixes were included between the A2 and B0 steppings. For the Pentium II, additional micro-operations were added to support the MMX instruction set. In several cases, "microcode assists" were added to handle rare corner-cases in a reliable way.
The Pentium 4 can have 126 micro-operations in flight at the same time. Micro-operations are decoded and stored in an Execution Trace Cache with 12,000 entries, to avoid repeated decoding of the same x86 instructions. Groups of six micro-operations are packed into a trace line. Micro-operations can borrow extra immediate data space within the same cache-line. Complex instructions, such as exception handling, result in jumping to the microcode ROM. During development of the Pentium 4, microcode accounted for 14% of processor bugs versus 30% of processor bugs during development of the Pentium Pro.
The Intel Core microarchitecture introduced in 2006 added "micro-operations fusion" for some common pairs of instructions including comparison followed by a jump. The instruction decoders in the Core convert x86 instructions into microcode in three different ways:
| x86 instructions | x86 decoders | micro-operations |
| common | simple decoder × 3 | 1–3 |
| most others | complex decoder × 1 | ≤4 |
| very complex | microcode sequencer | many |
For Intel's hyper-threading implementation of simultaneous multithreading, the microcode ROM, trace cache, and instruction decoders are shared, but the micro-operation queue is not shared.
Update facility
In the mid-1990s, a facility for supplying new microcode was initially referred to as the Pentium Pro Stepping data file, and BIOS Update Feature. It was intended that user mode applications should make a BIOS interrupt call to supply a new "BIOS Update Data Block", which the BIOS would partially validate and save to nonvolatile BIOS memory; this could be supplied to the installed processors on next boot.Intel distributed a program called
BUP_UTIL.EXE, renamed CHECKUP3.EXE that could be run under DOS. Collections of multiple microcode updates were concatencated together and numerically numbered with the extension .PDB, such as PEP6.PDB.Processor interface
The processor boots up using a set of microcode held inside the processor and stored in an internal ROM. A microcode update populates a separate SRAM and set of "match registers" that act as breakpoints within the microcode ROM, to allow jumping to the updated list of micro-operations in the SRAM. A match is performed between the Microcode Instruction Pointer all of the match registers, with any match resulting in a jump to the corresponding destination microcode address. In the original P6 architecture there is space in the SRAM for 60 micro-operations, and multiple match/destination register pairs. It takes one processor instruction cycle to jump from ROM microcode to patched microcode held in SRAM. Match registers consist of a microcode match address, and a microcode destination address.The processor must be in protection ring zero in order to initiate a microcode update. Each CPU in a symmetric multiprocessing arrangement needs to be updated individually.
An update is initiated by placing its address in
eax register, setting ecx = 0x79, and executing a wrmsr.Microcode update format
Intel distributes microcode updates as a 2,048 binary blob. The update contains information about which processors it is designed for, so that this can be checked against the result of the CPUID instruction. The structure is a 48-byte header, followed by 2,000 bytes intended to be read directly by the processor to be updated:- a microcode program that is executed by the processor during the microcode update process. This microcode is able to reconfigure and enable or disable components using a special register, and it must update the breakpoint match registers.
- up to sixty patched micro-operations to be populated into the SRAM.
- padding consisting of random values design to obfuscate understanding of the format of the microcode update.
With the Pentium there are two layers of encryption and the precise details explicitly not documented Intel, instead being only known to less than ten employees.
Microcode updates for Intel Atom, Nehalem and Sandy Bridge additionally contain an extra 520-byte header containing a 2048-bit RSA modulus with an exponent of 17 decimal.
| Micro architecture | Example processors | Supplied length | Functional length | Suspected encoding |
| P6 | 2000 | 864; 872; 944; 1968 | 64-bit block cipher | |
| Core | PIII … | 4048 | 3096 | 64-bit block cipher |
| Netburst | ,, Celeron | 2000–7120 | 2000 + N*1024 | chained block cipher |
| Atom, Nehalem, | 976–16336 | 976 + N*1024; 5120 | AES + RSA signature |
Debugging
Special debugging-specific microcode can be loaded to enable Extended Execution Trace, which then outputs extra information via the Breakpoint Monitor Pins. On the Pentium 4, loading special microcode can give access to Microcode Extended Execution Trace mode. When using the JTAG Test Access Port, a pair of Breakpoint Control registers allow breaking on microcode addresses.During the mid-1980s NEC and Intel had a long-running US federal court case about microcode copyright. NEC had been acting as a second source for Intel 8086 CPUs with its NEC μPD8086, and held long-term patent and copyright cross-licensing agreements with Intel. In August 1982 Intel sued NEC for copyright infringement over the microcode implementation. NEC prevailed by demonstrating via cleanroom software engineering that the similarities in the implementation of microcode on its V20 and V30 processors was the result of the restrictions demanded by the architecture, rather than via copying.
The Intel 386 can perform a built-in self-test of the microcode and programmable logic arrays, with the value of the self-test placed in the
EAX register. During the BIST, the microprogram counter is re-used to walk through all of the ROMs, with the results being collated via a network of multiple-input signature registers and linear-feedback shift registers. On start up of the Intel 486, a hardware-controlled BIST runs for 220 clock cycles to check various arrays including the microcode ROM, after which control is transferred to the microcode for further self-testing of registers and computation units. The Intel 486 microcode ROM has 250,000 transistors.AMD had a long-term contract to reuse Intel's 286, 386 and 486 microcode. In October 2004, a court ruled that the agreement did not cover AMD distributing Intel's 486 in-circuit emulation microcode.
Direct Access Testing
Direct Access Testing is included in Intel CPUs as part of the design for testing and Design for Debug initiatives allow full coverage testing of individual CPUs prior to sale.In May 2020, a script reading directly from the Control Register Bus was used to read from the Local Direct Access Test port of the Intel Goldmont CPU and the loaded microcode and patch arrays were read. These arrays are only accessible after the CPU has been put into a specific mode, and consist of five arrays accessed through offset 0x6a0: